The Romanian hacker whose cyber-mischief first revealed that Hillary Clinton used a private email address while she was secretary of state pleaded guilty Wednesday to aggravated identity theft and unauthorized access to a protected computer, admitting that he was responsible for a series of high-profile intrusions.

Marcel Lehel Lazar, 44, as a part of his plea, said that he victimized nearly 100 Americans from his home overseas, often by correctly guessing their passwords or the answers to their security questions.

His targets included former secretary of state Colin Powell, family members of former president George W. Bush and a host of celebrities, and his aim seemed to be to cause embarrassment. Lazar admitted in his plea that he often turned over his victims’ private correspondence to media outlets, affixing the materials with the moniker Guccifer to mark his handiwork.

In one instance, that correspondence included paintings by Bush, including apparent self-portraits in the shower and bath.

In U.S. District Court in Alexandria, Lazar, in a green jail jumpsuit, said little, offering only short confirmations that he was pleading guilty voluntarily and that he knew the rights he was giving up.

“They’re all accurate,” he said, after federal prosecutor Ryan Dickey read a summary of the facts to which he admitted.

According to his plea agreement, Lazar faces at least two years in prison for the aggravated identity theft charge and up to five years more for unauthorized access to a protected computer.

Federal investigators have no evidence to suggest Lazar accessed Clinton’s email address – despite his claim in a recent Fox News interview that he had done so – though he admitted as a part of his plea that he successfully broke into the account of Sidney Blumenthal, one of President Bill Clinton’s former aides. It was after Lazar released notes from Blumenthal to Hillary Clinton that Gawker noticed the correspondence was directed to a private, nongovernmental email account. The New York Times later reported that Clinton exclusively used a personal account to conduct government business.

Lazar was charged in the United States in 2014 and extradited to Alexandria earlier this year. He had been serving a sentence in Romania for hacking the personal accounts of various Romanians, including the then-director of the Romanian Intelligence Service.

In a wide-ranging, in-prison interview with journalist Matei Rosca last year, Lazar said he welcomed extradition to the United States and added, “I’ll plead guilty, no problem.”